CVE-2008-7278

CVE-2008-7278 describes a vulnerability in the S/MIME feature of Open Ticket Request System (OTRS) versions prior to 2.2.5 and 2.3.x before 2.3.0-beta1. The flaw stems from improper configuration of the RANDFILE environment variable for OpenSSL, which could lead to reduced cryptographic entropy. This misconfiguration might make it easier for remote attackers to decrypt S/MIME encrypted email messages due to insufficient randomness in cryptographic operations. The vulnerability has a CVSS score of 5.0, indicating a medium severity. It is a network-based attack with low complexity, requiring no authentication, and primarily impacts confidentiality (C:P). The EPSS score is very low at 0.00311, suggesting a minimal likelihood of exploitation in the wild. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are virtually nonexistent, aligning with the majority of CVEs that receive little public attention.